{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# DO NOT RUN THIS NOTEBOOK UNTIL THE PREVIOUS NOTEBOOK FINISHES COMPLETELY \n",
    "\n",
    "# THE PREVIOUS NOTEBOOK WILL TAKE 20-30 MINUTES.\n",
    "\n",
    "# PLEASE BE PATIENT"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "### Source the environment\n",
    "source ~/.bash_profile\n",
    "\n",
    "AWS_CLUSTER_STATUS=$(aws eks describe-cluster --name ${AWS_CLUSTER_NAME} --region ${AWS_REGION} --query \"cluster.status\" --output text)\n",
    "\n",
    "if [ -n \"$AWS_CLUSTER_STATUS\" ]; then\n",
    "    if [ $AWS_CLUSTER_STATUS == \"ACTIVE\" ]; then\n",
    "        echo \"Cluster status:  $AWS_CLUSTER_STATUS.  Please continue.\"\n",
    "    else\n",
    "        echo \"Cluster status:  $AWS_CLUSTER_STATUS.  Please wait for status:  Created\"\n",
    "        exit\n",
    "    fi\n",
    "else\n",
    "  echo \"Cluster status:  $AWS_CLUSTER_STATUS.  Please wait for status:  Created\"\n",
    "  exit\n",
    "fi"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# DO NOT CONTINUE UNTIL THE CLUSTER STATUS IS `ACTIVE` ^^ ABOVE ^^."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Associate IAM Policies with EKS Worker Nodes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "### Source the environment\n",
    "source ~/.bash_profile\n",
    "    \n",
    "AWS_CLUSTER_STATUS=$(aws eks describe-cluster --name ${AWS_CLUSTER_NAME} --region ${AWS_REGION} --query \"cluster.status\" --output text)\n",
    "\n",
    "if [ -n \"$AWS_CLUSTER_STATUS\" ]; then\n",
    "    if [ $AWS_CLUSTER_STATUS == \"ACTIVE\" ]; then\n",
    "        echo \"Cluster status:  $AWS_CLUSTER_STATUS.\"\n",
    "        aws iam list-roles \\\n",
    "            | jq -r \".Roles[] \\\n",
    "            | select(.RoleName \\\n",
    "            | startswith(\\\"eksctl-$AWS_CLUSTER_NAME\\\") and contains(\\\"NodeInstanceRole\\\")) \\\n",
    "            .RoleName\"\n",
    "\n",
    "        aws iam list-roles \\\n",
    "            | jq -r \".Roles[] \\\n",
    "            | select(.RoleName \\\n",
    "            | startswith(\\\"eksctl-$AWS_CLUSTER_NAME\\\") and contains(\\\"NodeInstanceRole\\\")) \\\n",
    "            .Arn\" \n",
    "\n",
    "        export INSTANCE_ROLE_NAME=$(aws iam list-roles \\\n",
    "            | jq -r \".Roles[] \\\n",
    "            | select(.RoleName \\\n",
    "            | startswith(\\\"eksctl-$AWS_CLUSTER_NAME\\\") and contains(\\\"NodeInstanceRole\\\")) \\\n",
    "            .RoleName\")\n",
    "        if [ -n \"$INSTANCE_ROLE_NAME\" ]; then\n",
    "            echo \"INSTANCE_ROLE_NAME:  $INSTANCE_ROLE_NAME\"\n",
    "            echo \"export INSTANCE_ROLE_NAME=${INSTANCE_ROLE_NAME}\" | tee -a ~/.bash_profile\n",
    "        else\n",
    "            echo \"Please re-run this notebook after cluster status:  ACTIVE.\"\n",
    "        fi\n",
    "\n",
    "        export INSTANCE_PROFILE_ARN=$(aws iam list-roles \\\n",
    "            | jq -r \".Roles[] \\\n",
    "            | select(.RoleName \\\n",
    "            | startswith(\\\"eksctl-$AWS_CLUSTER_NAME\\\") and contains(\\\"NodeInstanceRole\\\")) \\\n",
    "            .Arn\")\n",
    "        if [ -n \"$INSTANCE_PROFILE_ARN\" ]; then\n",
    "            echo \"INSTANCE_PROFILE_ARN:  $INSTANCE_PROFILE_ARN\"\n",
    "            echo \"export INSTANCE_PROFILE_ARN=${INSTANCE_PROFILE_ARN}\" | tee -a ~/.bash_profile\n",
    "        else\n",
    "            echo \"Please re-run this notebook after cluster status:  ACTIVE.\"\n",
    "        fi\n",
    "    else\n",
    "        echo \"Cluster status:  $AWS_CLUSTER_STATUS.  Please wait for status:  Created\"\n",
    "        exit\n",
    "    fi\n",
    "else\n",
    "  echo \"Cluster status:  $AWS_CLUSTER_STATUS.  Please wait for status:  Created\"\n",
    "  exit\n",
    "fi"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Attach Roles\n",
    "* Allow Access from/to the Elastic Container Registry (ECR)\n",
    "* This allows our cluster worker nodes to load custom Docker images (ie. models) from ECR. \n",
    "* We will load these custom Docker images in a later section."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "source ~/.bash_profile\n",
    "\n",
    "if [ -n \"$INSTANCE_ROLE_NAME\" ]; then\n",
    "    echo \"INSTANCE_ROLE_NAME:  $INSTANCE_ROLE_NAME\"\n",
    "    aws iam attach-role-policy --role-name $INSTANCE_ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess\n",
    "    echo \"Completed\"\n",
    "else\n",
    "    echo \"Please re-run this notebook when the EKS cluster status is ACTIVE.\"\n",
    "    exit\n",
    "fi"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Associate IAM and OIDC\n",
    "To use IAM Roles for Service Accounts in your cluster, you must create an OIDC identity provider in the IAM console.  \n",
    "\n",
    "See https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html for more info.\n",
    "\n",
    "# THIS WILL TAKE 5-10 MINUTES.  PLEASE BE PATIENT.\n",
    "\n",
    "# _If you see `retryable error`s below, this is OK!_"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "### Source the environment\n",
    "source ~/.bash_profile\n",
    "\n",
    "AWS_CLUSTER_STATUS=$(aws eks describe-cluster --name ${AWS_CLUSTER_NAME} --region ${AWS_REGION} --query \"cluster.status\" --output text)\n",
    "\n",
    "if [ -n \"$AWS_CLUSTER_STATUS\" ]; then\n",
    "    if [ $AWS_CLUSTER_STATUS == \"ACTIVE\" ]; then\n",
    "        echo \"Cluster status:  $AWS_CLUSTER_STATUS.\"\n",
    "        eksctl utils associate-iam-oidc-provider --cluster ${AWS_CLUSTER_NAME} --approve\n",
    "        echo \"Completed\"\n",
    "    else\n",
    "        echo \"Cluster status:  $AWS_CLUSTER_STATUS.  Please wait for status:  Created\"\n",
    "        exit\n",
    "    fi\n",
    "else\n",
    "  echo \"Cluster status:  $AWS_CLUSTER_STATUS.  Please wait for status:  Created\"\n",
    "  exit\n",
    "fi"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# _If you see `retryable error`s ^^ above ^^, this is OK!_"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "### Source the environment\n",
    "source ~/.bash_profile\n",
    "\n",
    "AWS_OIDC_ISSUER=$(aws eks describe-cluster --name ${AWS_CLUSTER_NAME} --region ${AWS_REGION} --query \"cluster.identity.oidc.issuer\" --output text)\n",
    "if [ -n \"$AWS_OIDC_ISSUER\" ]; then\n",
    "    echo \"AWS_OIDC_ISSUER:  $AWS_OIDC_ISSUER\"\n",
    "    echo \"Completed\"\n",
    "else\n",
    "    echo \"AWS_OIDC_ISSUER:  $AWS_OIDC_ISSUER\"\n",
    "    echo \"Something is wrong.\"\n",
    "fi"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Update `~/.kube/config` with our new EKS cluster"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "source ~/.bash_profile\n",
    "\n",
    "aws eks --region ${AWS_REGION} update-kubeconfig --name ${AWS_CLUSTER_NAME} "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Verify Your EKS Cluster\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "kubectl get ns\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "kubectl get nodes\n"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "conda_python3",
   "language": "python",
   "name": "conda_python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.10"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}
